CVE-2026-103937: CWE-459: Incomplete Cleanup in misskey-dev misskey
Description
Misskey, an open source federated social media platform, has a vulnerability in versions from 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0 where cleanup processing may not execute during file uploads. This can lead to resource exhaustion such as storage or file descriptors, causing a denial of service. The issue is fixed in version 2026.7.0.
CVSS v4.0
Score 8.7high
Affected software
misskey-dev
misskey
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103937 is an incomplete cleanup vulnerability (CWE-459) in Misskey affecting versions >=12.0.0 <=13.14.2, >=2023.9.0-beta.1 <2025.4.1, and >=2025.5.0 <2026.7.0. During file uploads, cleanup processing may fail to execute, allowing repeated uploads to exhaust storage or file descriptors, resulting in denial of service regardless of federation status. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. The issue is resolved in version 2026.7.0.
Potential Impact
The vulnerability allows an attacker to cause denial of service by exhausting storage or file descriptors through repeated file uploads without proper cleanup. This can disrupt availability of the Misskey platform. There is no indication of privilege escalation, data confidentiality loss, or integrity impact. Exploitation does not require user interaction or privileges.
Mitigation Recommendations
Upgrade to Misskey version 2026.7.0 or later, where the incomplete cleanup issue during file uploads is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-01T14:20:19.156Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace7d372cdf04f65699b429
Added to database: 10/13/2026, 18:49:27 UTC
Last enriched: 10/13/2026, 19:00:33 UTC
Last updated: 10/13/2026, 19:04:17 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.